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CLAIMS 

1 l>A5paratus for tightly-coupling hardware data encryption functions with software- 

2 based prot^eQ|decode processing within a pipelined processor^of a programmable proc- 

3 essing engine in a nfet^^k switch, the apparatus comprising: 

4 an encryption exec\mbisunit contained within the pipelined processor; and 

5 a software and hardware intermcfe^A^tenables the encryption execution unit to 

6 efficiently cooperate with resources of the pipeline^^pfoeessor. 

1 2. The apparatus of Claim 1 wherein the encryption execution unit is an encryption 

2 tightly coupled state machine (TCSM) unit that is selectively invoked within the.pipe- 

3 lined processor. 

1 3. The apparatus of Claim 2 wherein a software portion of the interface comprises native 

2 encryption opcodes provided within an instruction set of the pipelined processor to enable 

3 selective access to the encryption TCSM unit. 

1 4. The apparatus of Claim 3 wherein the resources include a plurality of busses internal 

2 to the pipelined processor and wherein a hardware portion of the interface allows the en- 

3 cryption TCSM unit to utilize the intemal buses in response to decode processing of the 

4 native encryption opcodes. 

1 5. The apparatus of Claim 4 wherein the pipelined processor is microcontroller core 

2 (TMC) processor having a multi-stage pipeline architecture that includes an instruction 

3 fetch stage, an instruction decode stage^, an execution stage and a memory write-back 

4 stage. 
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1 6. The apparatus of Claim 5 wherein the TMC processor further includes an arithmetic 

2 logic unit, at least one internal register, an instruction fetch and decode unit and the en- 

3 cryption TCSM unit organized as a data path. 

1 7. The apparatus of Claim 5 wherein the encryption TCSM unit comprises a data en- 

2 cryption standard (DES) functional component cooperatively coupled to a sub-key gen- 

3 eration functional component. 

1 8. The apparatus of Claim 7 wherein the DES functional component comprises state ma- 

2 chine hardware used to execute each round of a DES function. 

1 9. The apparatus of Claim 7 wherein the sub-key generation functional component com- 

2 prises state machine hardware that generates a sub-key as needed for each round of the 

3 DES function. 

1 rO>.Amethod for tightly-coupling hardware data encryption functions with software- 

2 based protocljWecode processing within a pipelined processor of a programmable proc- 

3 essing engine in a netwo?lss^ch, the method comprising the steps of: 

4 providing an encryption exScu^on unit within the pipelined processor; and 

5 selectively accessing the encryption^^ceQution unit through an integrated hard- 

6 ware and software interface of the pipelined processoHh^allows efficient cooperation 

7 between the encryption execution unit and resources of the pipfeiki^ processor. 

1 11. The method of Claim 1 0 wherein the integrated interface comprises native encryption 

.2 opcodes contained within an instruction set of the pipelined processor and wherein the 

3 step of selectively accessing comprises the step of issuing the native encryption opcodes 

4 directly to the encryption execution unit to substantially reduce encryption setup latency. 
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12. The method of Claim 1 1 further comprising the steps of, wherein the pipeUned proc- 
essor is a microcontroller core (TMC) processor having a multi-stage pipeline architec- 
ture that includes an instruction decode stage and an execution stage: 

decoding the native encryption opcodes at the instruction decode stage; and 
in response to the step of decoding, invoking the encryption execution unit to per- 
form encryption/decryption functions at the execution stage. 

13. The method of Claim 12 further comprising the steps of, wherein the encryp- 
tion/decryption functions are performed on plaintext stored at the network switch: 

protocol processing of protocols contained in the plaintext to determine an appro- 
priate encryption algorithm; 

upon determining the appropriate encryption algorithm, inmiediately starting an 
operation to fetch initial keys needed to perform the encryption/decryption functions; and 

upon fetching the keys, providing the keys to the encryption execution unit within 
the TMC processor. 

14. The method of Claim 13 wherein the resources include a plurality of high- 
performance busses internal to the TMC processor, and wherein the step of invoking 
comprises the step of: 

accessing the internal busses through the integrated interface to simultaneously 
load an encryption key and store a previous encryption result. 

15. The method of Claim 12 further comprising the step of, wherein the the encryption 
execution unit is an encryption tightly coupled state machine (TCSM) unit: 

initializing the encryption TCSM unit in response to execution of a first instruc- 
tion that defines the form of operation to be performed. 
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1 6. The method of Claim 1 5 wherein the encryption TCSM unit comprises a data en- 
cryption standard (DES) functional component cooperatively coupled to a sub-key gen- 
eration functional component and wherein the step of initializing comprises the steps of: 

decoding a first portion of the first instruction to initialize the DES functional 
component; and 

decoding a second portion of the first instruction to initialize the sub-key genera- 
tion functional component. 

17. The method of Claim 16 further comprising the step of: 

executing a second instruction having a micro-opcode field containing a native 
encryption opcode that specifies loading an initial key firom a memory into the sub-key 
generation functional component of the encryption TCSM unit. 

18. The method of Claim 17 further comprising the step of: 

performing a DES function on the plaintext in response to execution of a third in- 
struction having a micro-opcode field containing a native encryption code that specifies 
loading of the plaintext into the DES functional component of the encryption TCSM unit 
and initiating DES operations; and 

upon completing the DES operations, storing ciphertext results in an internal reg- 
ister coupled to the DES functional component. 

19. The method of Claim 18 further comprising the step of: 

executing a fourth instruction to store the ciphertext results contained in the inter- 
nal register to a location in the memory. 

20. A progr&Hmiable processing engine of a network switch comprising: 
an input header buffer; 



an output header bufiEor; and 
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a pluratitv of processing complex elements symmetrically arrayed into rows and 
columns that are emb^ded between the input header buffer and an output header buffer, 
each processing complex ekment comprising a microcontroller core having an encryption 
tightly coupled state machine ( TOSM) unit that is selectively invoked through an inte- 
grated hardware and software interfacebfAe microcontroller core to allow efficient co- 
operation between the encryption TCSM unit ati4data path resources of the microcontrol- 
ler core. 
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